Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 21:28

General

  • Target

    locales/uk.ps1

  • Size

    657KB

  • MD5

    361a0e1f665b9082a457d36209b92a25

  • SHA1

    3c89e1b70b51820bb6baa64365c64da6a9898e2f

  • SHA256

    bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a

  • SHA512

    d4d25fc58053f8cce4c073846706dc1ecbc0dc19308ba35501e19676f3e7ed855d7b57ae22a5637f81cefc1aa032bf8770d0737df1924f3504813349387c08cf

  • SSDEEP

    12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\locales\uk.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1676

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1676-4-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

          Filesize

          2.9MB

        • memory/1676-5-0x0000000002350000-0x0000000002358000-memory.dmp

          Filesize

          32KB

        • memory/1676-6-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB

        • memory/1676-7-0x0000000002C60000-0x0000000002CE0000-memory.dmp

          Filesize

          512KB

        • memory/1676-9-0x0000000002C60000-0x0000000002CE0000-memory.dmp

          Filesize

          512KB

        • memory/1676-10-0x0000000002C60000-0x0000000002CE0000-memory.dmp

          Filesize

          512KB

        • memory/1676-11-0x0000000002C60000-0x0000000002CE0000-memory.dmp

          Filesize

          512KB

        • memory/1676-8-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB

        • memory/1676-12-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

          Filesize

          9.6MB